Reference

Keys & credentials

Manage the three credential classes MerasPay uses: opaque API keys (sk_test_ / sk_live_ / pk_test_ / pk_live_), RSA keypairs for provider signing (D-Money etc.), and webhook signing secrets.

3 classes10 endpoints

ℹ

Auth model

All endpoints on this page require a logged-in merchant session (JWT), not an API key — you can't use one key to mint another. From the merchant portal go to Settings → Keys; the buttons there call these endpoints.

API keys

GET/v1/merchants/me/api-keys

List the merchant's keys (hashed; plaintext was shown once at creation).

POST/v1/merchants/me/api-keys

Issue a new sk_ or pk_ key.

POST/v1/merchants/me/api-keys/{id}/rotate

Rotate — old key keeps working for a grace window (default 24h).

DELETE/v1/merchants/me/api-keys/{id}

Revoke immediately.

Issue

Name	Type	Description
`environment` required	enum	"sandbox" or "live".
`key_type`	enum	"secret" (default) — for sk_; "publishable" — for pk_ (browser-safe).
`label`	string	Free-form name shown in the portal.
`scopes`	array	["payments:write","reports:read",...]. Default: full scope on the merchant.
`ip_allowlist`	array	["1.2.3.0/24"] — empty = any IP.

bashbash

curl -X POST https://api.merashub.com/v1/merchants/me/api-keys \
  -H "Authorization: Bearer <merchant-session-jwt>" \
  -d '{
    "environment": "live",
    "key_type": "secret",
    "label": "Production backend"
  }'

201 Created · plaintext shown oncejson

{
  "id": "key_01HZ...",
  "prefix": "sk_live_abc12345",
  "key_type": "secret",
  "environment": "live",
  "plaintext_key": "sk_live_abc12345def6789...REST_OF_KEY",
  "warning": "Save this key now — it won't be shown again."
}

RSA keypairs

For providers that require RSA-signed requests (D-Money). The private half is encrypted at rest under a per-merchant DEK; you never see it. The public PEM is exposed for verification.

GET/v1/merchants/me/rsa-keys

List your active RSA keypairs.

POST/v1/merchants/me/rsa-keys

Generate a new 2048-bit keypair.

DELETE/v1/merchants/me/rsa-keys/{kid}

Revoke a keypair.

Webhook endpoints

GET/v1/merchants/me/webhook-endpoints

List your registered webhook endpoints.

POST/v1/merchants/me/webhook-endpoints

DELETE/v1/merchants/me/webhook-endpoints/{id}

Revoke an endpoint.

⚠

Plaintext shown once

API keys, webhook signing secrets, and RSA private PEMs (well — the latter we don't return; the others we do once) are visible exactly once at creation. Lose it → rotate. We can't recover it.